<!DOCTYPE html>
<html>

<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>SpringBoot 漏洞测试</title>
  <link href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.5/css/bootstrap.min.css" rel="stylesheet">
  <script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.0/angular.min.js"></script>
  <style media="screen">
    thead tr td {
      background-color: #f1f1f1
    }
  </style>
</head>

<body>
  <div ng-app="myapp" ng-controller="main">
    <div class="container" id="main">
      <div class="row">
        <div class="col-xs-12 col-sm-8 col-sm-offset-2">
          <h3 class="text-center">SpringBoot 漏洞测试</h3>
          <br />
          <table class="table table-striped">
            <thead>
              <tr>
                <td>测试用例</td>
                <td>用例路径</td>
              </tr>
            </thead>
            <tbody>
              <tr ng-repeat="a in testcases">
                <td>{{a.name}}</td>
                <td><a target="_blank" ng-href="{{a.path}}">{{a.path}}</a></td>
              </tr>
            </tbody>
          </table>
        </div>
      </div>
    </div>
  </div>

  <script type="text/javascript">
    var app = angular.module('myapp', []);

    app.controller('main', ['$scope', '$http',
      function ($scope, $http) {
        $scope.testcases = [
          { "name": "spring xml context (app)", "path": '/bean/app?url=http://127.0.0.1/test.xml' },
          { "name": "spring xml context (fs)", "path": '/bean/file?url=http://127.0.0.1/test.xml' },
          { "name": "xstream", "path": '/xstream/parse' },
          { "name": "jndi lookup", "path": '/jndi/lookup?url=rmi://127.0.0.1:1089' },
          { "name": "log4j", "path": '/log4j?log=%24%7Bjndi:ldap://127.0.0.1:1389/a%7D' },
          { "name": "snakeyaml", "path": '/snakeyaml/parse?yaml=%5B%5D' },
          { "name": "mvel", "path": '/mvel/parse?expression=%23user' },
          { "name": "ognl", "path": '/ognl/parse?expression=%23user' },
          { "name": "spel", "path": '/spel/parse?expression=T(java.lang.Runtime)' },
          { "name": "freemarker (unsafe)", "path": '/freemarker/unsafe?template=%3Ch1%3E%3C/h1%3E' },
          { "name": "freemarker (safe)", "path": '/freemarker/safe?template=%3Ch1%3E%3C/h1%3E' },
          { "name": "fastjson", "path": '/fastjson/parse?json=%7B%7D' },
          { "name": "jodd-json", "path": '/jodd/parse?json=%7B%7D' },
          { "name": "jackson", "path": '/jackson/parse?json=%7B%7D' },
          { "name": "actuator", "path": '/actuator/' },
          { "name": "jolokia", "path": '/actuator/jolokia/' },
          { "name": "permission", "path": '/permission/no-auth/%2e%2e/auth' },
          { "name": "thymeleaf (path)", "path": '/thymeleaf/path?lang=1' },
          { "name": "thymeleaf (fragment)", "path": '/thymeleaf/fragment?section=1' },
          { "name": "readObject", "path": '/object/parse' },
          { "name": "swagger-ui", "path": '/swagger-ui.html' },
        ]
      }
    ]);
  </script>

</body>
<!-- design, implemented by c0debreak -->

</html>